Vulnerability Description
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tox-Dev | Filelock | >= 3.20.4, < 4.0.9 |
Related Weaknesses (CWE)
References
- https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114Patch
- https://github.com/tox-dev/filelock/releases/tag/4.0.9Release Notes
- https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56ExploitVendor Advisory
- https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56ExploitVendor Advisory
FAQ
What is CVE-2026-112936?
CVE-2026-112936 is a vulnerability with a CVSS score of 6.1 (MEDIUM). filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejectin...
How severe is CVE-2026-112936?
CVE-2026-112936 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-112936?
Check the references section above for vendor advisories and patch information. Affected products include: Tox-Dev Filelock.